Hello, all 24 below public programs aren't fetched. I think it's something to have with the new url format engagements/xxxxxx maybe ?!

https://bugcrowd.com/engagements/odesk
https://bugcrowd.com/engagements/caffeine
https://bugcrowd.com/engagements/cloudinary
https://bugcrowd.com/engagements/elementor
https://bugcrowd.com/engagements/mettle
https://bugcrowd.com/engagements/ynab
https://bugcrowd.com/engagements/contrast-security
https://bugcrowd.com/engagements/dropbox
https://bugcrowd.com/engagements/rarible-ogmbb
https://bugcrowd.com/engagements/cfr
https://bugcrowd.com/engagements/bitstamp
https://bugcrowd.com/engagements/lime
https://bugcrowd.com/engagements/classdojo
https://bugcrowd.com/engagements/shipwire
https://bugcrowd.com/engagements/codeorg
https://bugcrowd.com/engagements/freedomofpress
https://bugcrowd.com/engagements/acorns
https://bugcrowd.com/engagements/foxycart
https://bugcrowd.com/engagements/tyler-tech-data-insights
https://bugcrowd.com/engagements/humblebundle
https://bugcrowd.com/engagements/planethosterinc
https://bugcrowd.com/engagements/whmcs
https://bugcrowd.com/engagements/directly
https://bugcrowd.com/engagements/immutable

Hi
It appears that both Intigriti, and YesWeHack out_of_scope is not being scraped,
They are blank for all programs.
I wish I had enough knowledge in GO to resolve it, but I cannot :(
Thanks

Hi there, it seems like the data available for Bugcrowd in bugcrowd_data.json is missing quite a few programs, for example Tesla. I am not sure what is causing this but it does seem to result in a lot of missing entries. Sorry that I have not debugged it any further!

Hi ! on bounty-targets-data we can see last update is 8 days ago. The bot might be broken

Is it possible for this to be extended to include the excluded urls too?

Hello,
Pure coincidence that I checked for the Uber scope in the output and noticed that it isn't there.
Not sure why at all, it should include *.uber.com although it's possibly difficult to automate that due to how it appears?

There are some domains in wildcards.txt that contain parentheses around wildcards (e.g (*).endlcdn.site, (*).theendlessweb.com). What do these mean?

Do they mean to include only subdomains below those listed domains and not the parent domain (i.e. abc.endlcdn.site, but not endlcdn.site)?

Thank you.

• https://www.linkedin.com/company/bugbounter/

Program list:

• https://app.bugbounter.com/programs

how to grab domains using authenticated account of h1, bc etc. ?

Can you also add the OpenBugBounty bugbounty programs?

https://www.openbugbounty.org/bugbounty-list/

Hi! There is an error in script that parsing companies from h1, that leads to some misinformation. In particular, the raw data collected by your script indicates that paypal does not pay bounty, however, just click on the link of their program to make sure that this is not truth. The same about Airbnb

It seems that the bounty-targets-data is not updated in 2 weeks. Issues with platform api's?

Hi ! on bounty-targets-data we can see last update is 8 days ago. The bot might be broken

Hi,

With the recent updates, the parser is now invalidly parsing the OOS domains.

[Intigriti]

There is not a single OOS domain for Intigriti: https://github.com/arkadiyt/bounty-targets-data/blob/main/data/intigriti_data.json

If you check any program, no valid OOS domain is scraped for it.

[Bugcrowd]

The OOS domains are improperly scraped with empty JSON objects. e.g.

• https://bugcrowd.com/tripadvisor-bb-og

and

• https://github.com/arkadiyt/bounty-targets-data/blob/main/data/bugcrowd_data.json

--

In addition, I believe this is one of the main commits that removed lots of OOS domains:

arkadiyt/bounty-targets-data@b559c43

Best regards,
HolyBugx

Hello !

It seems hackenproof data are not working properly anymore.

Example :
On https://github.com/arkadiyt/bounty-targets-data/blob/master/data/hackenproof_data.json
"/codex/codex-exchange" is empty but https://hackenproof.com/codex/codex-exchange shows in scope domains.

hello hackerone "taking a break" programs are not fetched like https://hackerone.com/caesars-digital?type=team

now not in https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/master/data/hackerone_data.json

they are temporary paused often to high reports so they need time to handle while not receiving any new ones or sometimes on holidays programs take a break.

https://bugcrowd.com/bigcommerce -> *.bigcommerce.com and *.bigcommerce.net

In https://raw.githubusercontent.com/arkadiyt/bounty-targets-data/master/data/bugcrowd_data.json ->

{
"type": "website",
"target": ""
},
{
"type": "website",
"target": ""
},

没有爬取到目标站点，只爬取到了title

The bounty-targets-data is not updated since 2 weeks. Issues with platform api's?

Hi there, I think the new Bugcrowd parsing in 0c33ecc inadvertently prevented picking up programs which contain multiple in-scope groups, as it just pulls out the first parsed group for in-scope and out-of-scope and uses that. This results in programs like Arlo (https://bugcrowd.com/arlo) not having any domains, because they are all in the second in-scope group.

I think the fix is something like the following, to extract all groups and flatten them (non-recursively), but my Ruby is a little rusty and I had trouble getting this to work for every program. Hopefully someone knows the best syntax for this.

targets: {
  in_scope: scopes_to_hashes(content['groups'].find_all { |group| group['in_scope'] == true }.reduce([], :concat)),
  out_of_scope: scopes_to_hashes(content['groups'].find_all { |group| group['in_scope'] == false }.reduce([], :concat))
}

Hi, pls for federacy add offers_awards or not as a field in federacy scope file.

offers_awards yes/no is here https://www.federacy.com/api/public_programs/

I dont really know about what can you do on yeswehack but intigriti has an underlying api which can help you scrape the scope of a program: for example:

https://api.intigriti.com/core/program/randstad/randstad

I think it follows this scheme: https://api.intigriti.com/core/program/company_handle/program_name

This would really be useful to collect all the wildcard domains in one place for recon purposes. If you don't want to clutter the data you can create 2 new files for wildcard and regular external program scopes. I think it is a missed opportunity to not crawl the community curated pages.

If I knew ruby I would create a pull request sorry :/

Hi,

Can you add an option to only download H1 or BC or .... scope, those when any platform API will fail we can work with other platforms.

when h1 api changed, we cannot use the tool anymore to fetch other platforms scope..

Hi ! on bounty-targets-data we can see last update is 12 days ago. The bot might be broken